Virginia Department of Health Professions Breach: Extortion Demand Regarding 8M Patient Records and 35M Prescriptions

Information Week is covering a story involving an extortion letter sent last week to the Virginia Department of Health Professions seeking $10M to return more than 8M patient records and 35M prescriptions allegedly stolen from the Virginia Department of Health Professions.

The extortion demand was posted on WikiLeaks. The WikiLeaks website states:

May 3, 2009
Summary

On Thursday, April 30, the secure site for the Virginia Prescription Monitoring Program (PMP) was replaced with a $US10M ransom demand:

"I have your shit! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(For $10 million, I will gladly send along the password."

The site, https://www.pmp.dhp.virginia.gov/pmpwebcenter/login.aspx appears to have been entirely disabled and is presently unavailable.
The linked file provides the full ransom message.
The PMP is used by pharmacists and others to discover prescription drug abuse.
The PMP declined to comment, although when contacted, appeared to be aware of the issue, instantly referring inquiries to the director of the DHP, who is presently unavailable.

The Virginia Department of Health Professions website indicates that they are "currently experiencing technical difficulties which affet computerand email systems."

Sandra Whitely Ryals, Director of Virginia Department of Health Professionals, responded to the inquiry by Information Week stating that "a criminal investigation is under way by federal and state authorities."

The Washington Post Security Fix blog is also covering this story. Follow more news on this story via Google News.


UPDATE (5/5/09): At the bottom of his follow up post, John Chilmark asks the question: "Now the question is, under HIPAA, does the VDHP have to send out breach notifications to all consumers whose records have been compromised?

Here is my quick assessment. The HIPAA privacy rule (pre-ARRA HITECH) does not contain provisions that require a covered entity to notify individuals impacted by an alleged breach. However, when I have assisted clients with these types of data breach situations in the past I typically discuss with the client whether it is good practice to provide notification. The HIPAA privacy rule provisions do contain a requirement that a covered entity should mitigate potential harm to patients/individuals when there is a violation of the privacy rule. My interpretation is that this might, under certain circumstances, include providing notice to such individuals whose data has been compromised. Also, a question that factors into the equation is whether or not the Virginia Department of Health Professsions qualifies as either a covered entity or business associate under the HIPAA privacy rule. Handling these situations are very fact specific and depend upon a number of factors.

The new federal breach notification requirements contained in the HITECH section of the American Recovery and Reinvestment Act (ARRA) do not apply because the provisions do not go into effect until 30 days after the Department of Health and Human Services (HHS) publishes the interim final data breach notification regulations which has not yet occurred. The new federal breach notification law will be implemented in conjunction with the Federal Trade Commission's (FTC) proposed health breach notification rule that will apply to PHRs, PHR related vendors and other third party providers. The proposed rule is currently out for comment.

The regulations are currently in the works and HHS has now issued initial guidance on what data is classified as unsecured protected health information (not secured by technology that renders it "unusable, unreadable or indecipherable"). See the April 27, 2009 guidance for more on what this means. The guidance outlines the types of technologies that, if used, create a safe harbor for HIPAA privacy covered entities adn business associates to avoid having to provide notice in a situation where there has been a breach.

Also, the VDHP will likely have to assess the Virginia Data Breach Act (state-by-state survey of state breach laws by the National Conference of State Legislatures) to see whether notification or other action is required under state law.Over 40 states now have distinct state laws governing breach notification that extend to and cover everything from traditional personal information (name, social security number, etc.) to health related information. I've not dealt nor reviewed the Virginia Act but suspect a strong likelihood that notification will be required.

UPDATE (5/6/09): The Roanoke Times provides an update on the status of the pending investigation with comments from Governor Tim Kaine. The article states:

Gov. Tim Kaine said today that a hacker’s reported access to patient prescription records from a state database was “an intentional criminal act against the commonwealth by somebody who was trying to harm others” . . .

The FBI and the Virginia State Police are investigating the matter. Kaine said he could not discuss the probe.

“Right now our goal is to make sure that the investigation and criminal process works so that the person who is responsible is caught and prosecuted . . . and that we protect people whose data has been compromised,” Kaine said this morning.

The article also indicates that under Virginia law notification is required and that Virginia's breach notification law requires, like many state laws, that notice must be provided "without unreasonable delay."

The article also indicates that Virginia law requires notification of individuals whose personal information may have been accessed due to a computer security breach. The law states that notification must be provided “without unreasonable delay.”

Charleston FestivALL 2009: A City Becomes A Work Of Art

The preliminary lineup of events for Charleston FestivALL 2009 was announced today. Ten days of music, art, theater, entertainment, creativity and fun bring the city of Charleston alive from June 19 - 27, 2009. Where the city become a work of art!

As many of my friends, colleagues and regular readers know I love the Charleston FestivALL (my past posts) and am already excited about this years expanded ten day event. The event highlights why I love West Virginia and its creative powers and people. To experience a visual understanding of this feeling check out FestivALL from 2006-2009 through the eye of Rick Lee.

The image above will be a part of the official FestivALL 2009 poster. This year's poster, conceived and designed by Alex Morgado, is a symbol of the FestivALL idea. Local artists have contributed designs for letters. At the opening ceremonies, each letter will be taken to a different part of the city where it will be displayed during the ten days of FestivALL. At the end, they will be gathered and displayed together.

Check out the schedule of events (and pre-festival events) by FestivALL Executive Director, Larry Groce. Also, the lineup was announced in today's Charleston Gazette. Last year there were 83 different events featuring 169 performances, exhibitions and presentations by 378 companies, troupes and individual artists.

UPDATE (5/12/2009): FestivALL has launched its new web site which includes a full 2009 schedule. The web site has a cool and creative roll over of the artwork, "A City Becomes A Work Of Art." Check it out.

Google Experimental Flu Trends for Mexico

Google Flu Trends have launched an Experimental Flu Trends for Mexico as a result of the ongoing concern over the current swine flue outbreak. The experimental model for Mexico shows estimates on possible flu activity in the various states in Mexico. Google Flu Trends uses aggregated Google search data to estimate possible flu activity in near real-time.

Additional details on how the Experimental Flu Trends for Mexico works and FAQs. More information about Google Flu Trends in my prior post.

Thanks to @rzeiger for the Twitter tip on the launch of the experimental tracker.

AHLA Teleconference: HIPAA Privacy Fundamentals

Next month I will be co-presenting on an American Health Lawyer Association Teleconference on the topic of HIPAA Privacy Regulation Fundamentals - An Introductory Course.

The teleconference is scheduled for May 13, 2009, 1:00 - 2:30 pm EST. My co-presenter is Rebecca L. Williams of Davis Wright Tremaine LLP and the moderator will be Phyllis Granade of Adorn & Yoss.

This teleconference is geared toward a gaining a basic understanding of HIPAA privacy law for health lawyers (think, HIPAA 101). We will also be discussing the impact of the changes unde rthe HITECH Act of 2009. Although geared toward health lawyers this teleconference would also be valuable for health care professionals and others in the industry interested in learning more about HIPAA.

You can find out more about the teleconference and how to register via the AHLA website.

WV Senator Rockefeller: The Health Information Technology Public Utility Act of 2009

Yesterday West Virginia Senator Jay Rockefeller introduced "The Health Information Technology Public Utility Act of 2009"(Senate Bill 890) to facilitate the nationwide adoption of electronic health records (EHRs) though an "open source" public utility model.

A copy of Senate Bill 890 is available on Thomas (GPO PDF version).  According to the press release the Act would:

• Create a new federal Public Utility Board within the Office of the National Coordinator for Health IT to direct and oversee formation of this HIT Public Utility Model, its implementation, and its ongoing operation.
• Implement and administer a new 21st Century Health IT Grant program for safety-net providers to cover the full cost of open source software implementation and maintenance for up to five years, with the possibility of renewal for up to five years if required benchmarks are met.
• Facilitate ongoing communication with open source user groups to incorporate improvements and innovations from them into the core programs.
• Ensure interoperability between these programs, including as innovations are incorporated, and develop mechanisms to integrate open source software with Medicaid and CHIP billing.
• Create a child-specific Electronic Health Record (EHR) to be used in Medicaid, CHIP, and other federal children’s health programs.
• Develop and integrate quality and performance measurement into open source software modules.

Microsoft and Mayo Clinic Collaboration: Mayo Clinic Health Manager

Today Microsoft Corporation and Mayo Clinic announced a new consumer online health service called Mayo Clinic Health Manager, build on the HealthVault platform.

The press release states that Mayo Clinic Health Manager provides individuals "a place to store medical information and receive real-time individualized health guidance and recommendations based on the clinical expertise of Mayo Clinic . . . [extending] the capabilities of traditional personal health records, using an individual's health information to generate customized recommendations on which they can act to help them better manage their health and the health of their families."

Learn more from the Media Kit or take a tour.

How does this change the current PHR landscape?

Like others who have been commenting today I see this as combining the power brand of Mayo Clinic and its guidelines with what appears to be simple PHR tools designed to allow you to record, track, monitor, etc. your health information. However, at this point it still doesn't get over the hurdle of the individual having to individually input their own data.

Will health consumers become engaged to take on this role? Can providers and payors start to feed good data into the system to lessen the burden on the consumer/patient? What role will state and federal payors play in these systems? How will we all address the issues raised by Dave deBronkart (e-patientDave) which have been the center of discussion on the health blogosphere the past couple of weeks.

More questions than answers.

UPDATE (4/23/09): Did Microsoft sign a HIPAA Business Associate Agreement as a part of the collaboration? In HIPAA lawyer jargon the real question is "whether Mircrosoft is offering a service for or on behalf of the Mayo Clinic and is receiving protected health information." Answer per Microsoft from Nei Versel's Healthcare IT Blog.

Fourth Circuit Affirms Summary Judgment Under Health Care Quality Improvement Act of 1986

Congratulations to my partners, Rick Jones and David Givens for successfully defending Charleston Area Medical Center, Inc. before the United States Court of Appeals for the Fourth Circuit in the matter of Wahi v. Charleston Area Medical Center, Inc., et al., Slip Op. No. 06-2162 (4th Cir. April 10, 2009). Rick argued the case against well known lawyer, Kenneth Starr, who represented Rakesh Wahi, M.D., the appellant in the matter.

Following is a summary and some of the significant points regarding the impact on peer review privileges.

Wahi v. Charleston Area Medical Center, Inc., et al., Slip Op. No. 06-2162 (4th Cir. April 10, 2009) is a significant decision analyzing the immunity provisions of the Health Care Quality Improvement Act of 1986 (“HCQIA”). It affirms summary judgment on various claims made by the Plaintiff, a cardiothoracic surgeon, arising from the suspension of his privileges at Charleston Area Medical Center (“CAMC”), a Charleston, West Virginia hospital. The underlying facts and procedural history span over a decade of Dr. Wahi's tenure at CAMC. Dr. Wahi was granted privileges at CAMC in 1993. For a variety of reasons, CAMC summarily suspended his privileges in 1996 and reported the suspension, as required, to the National Practitioner Data Bank ("NPDB"). Following rehabilitative efforts, Dr. Wahi was granted restricted privileges.

Subsequently, there were documented instances of Wahi practicing outside the scope of his restricted privileges, as well as charges of practicing below the standard of care. In July 1999, Dr. Wahi was again summarily suspended, and requested a hearing under the applicable provisions of the hospital’s governing documents.

Not satisfied with the hearing procedures set forth in the governing documents, Dr. Wahi retained counsel to negotiate with the hospital over the hearing process. He objected to the hearing examiners, procedures, and ultimately sought the intervention of a state circuit court before the hearing process even began. Following the state court's refusal to intervene, Dr. Wahi ceased efforts to move forward with the hearing process and, some five years later, filed suit in the United States District Court for the Southern District of West Virginia alleging anti-trust monopolization and conspiracy, breach of contract, civil rights conspiracy, defamation and breach of contract. Following limited discovery on the application of immunity under HCQIA1, CAMC moved for summary judgment. Judge Goodwin granted CAMC's motion as to all counts finding that Dr. Wahi failed to rebut the statutory presumption of immunity. Dr. Wahi appealed.

The Fourth Circuit found that Dr. Wahi abandoned any appellate claim as to three of the four prongs under the HCQIA immunity standards and focused its immunity analysis solely on the issue of whether CAMC’s failure to actually set and hold a hearing deprived the hospital of its legally presumed immunity.

The Fourth Circuit affirmed summary judgment, finding the hospital was immune for its actions under the HCQIA despite the fact that a hearing was never actually scheduled or conducted. CAMC’s notification to Dr. Wahi of the charges, the hospital’s many attempts to provide a hearing, and Dr. Wahi’s non-cooperation in the hearing process led the court to conclude that CAMC’s process, when considered in its totality, satisfied the minimum standard of reasonableness required under HCQIA. The Court found that Dr. Wahi’s evidence was simply insufficient to overcome the statutory presumption of immunity under HCQIA, and affirmed the district court's ruling.

The Court also affirmed the District Court’s refusal to grant injunctive relief, finding Wahi did not prove CAMC committed any wrong; that CAMC was not a “state actor” for purposes of § 1983 claims; that he failed to amend his complaint to include a defamation claim, making it non reviewable on appeal; and, that because the hospital bylaws did not form a contract under state law, Dr. Wahi could not allege breach of contract for any violation of the bylaws. A final argument rejected by the Court was Dr. Wahi’s claim that CAMC breached confidentiality required by 45 C.F.R. § 60.13 by disclosures to the press, finding the NPDB “does not prevent the entity who reported NPDB from disclosing the mere fact that a report was filed.”

The Wahi opinion has significance for hospitals and others involved in peer review matters:

• HCQIA provides a means of minimizing and limiting discovery to issues related to the availability of immunity to a hospital. HCQIA provides a vehicle through which a hospital may obtain summary disposition of cases without running the risks associated with a jury trial.
• For a hospital to avail itself of HCQIA immunity, there need not be precise compliance with all the elements of one’s governing documents, but the hospital may show from a totality of the circumstances that its handling of the matter was objectively reasonable.
• HCQIA’s “safe harbor” provisions should be read expansively and not narrowly construed.
• The reasonableness of a hospital’s actions is not a subjective determination, and neither good nor bad motives should be considered; rather, the court should look at the objective, overall reasonableness of the hospital’s actions, even if it is later determined that the facts were different or the standard of care was actually met.
• A hospital should use care in properly documenting the information upon which it acts and the manner of notifying the physician of the charges and, above all else, make sure the physician is fully advised of the charges and given the opportunity to explain or rebut any charges against him. Proper documentation of all the steps required for HCQIA is crucial.

Rick and David would like to recognize fellow partner, Nate Tawney, and associate, Justin Jack who also worked on defending the matter and assisted in the preparation of this summary.